Skip to main content

End-to-end encryption

Mozilla accounts offers an end-to-end encryption support feature for OAuth reliers by deriving a strong encryption key from user's password. Keep in mind that Mozilla accounts does not provide a storage solution, it is up to you to use the generated key and encrypt the data with that key.


To use this feature in WebExtensions you need to do the following:

  1. Register an OAuth client and an OAuth app scope with Mozilla accounts
  2. Install the fxa-crypto-relier library into your WebExtension
  3. Follow the documentation to trigger the Mozilla accounts login screen
  4. Consume the derived key after the successful login


You can find an example of this feature in the TestPilot Notes source code. Here's a simplified diagram of a scoped key generated for a WebExtension:

An example of a key generated by Mozilla accounts:

The generated key can be imported using existing WebCrypto APIs:

function shared_key(key) {
return crypto.subtle.importKey(
{ kty: key.kty, k: key.k.replace(/=/, '') },
['wrapKey', 'unwrapKey']